diff --git a/data/templates/bookmarks.tpl.php b/data/templates/bookmarks.tpl.php
index a8299fd..dab2f37 100644
--- a/data/templates/bookmarks.tpl.php
+++ b/data/templates/bookmarks.tpl.php
@@ -199,7 +199,7 @@ if($currenttag!= '') {
 	$brss = '';
 	$size = count($rsschannels);
 	for ($i = 0; $i < $size; $i++) {
-		$brss =  '<a style="background:#FFFFFF" href="'. $rsschannels[$i][1] .'" title="'. $rsschannels[$i][0] .'"><img src="'. ROOT .'images/rss.gif" width="16" height="16" alt="'. $rsschannels[$i][0] .'" /></a>';
+		$brss =  '<a style="background:#FFFFFF" href="'. $rsschannels[$i][1] .'" title="' . htmlspecialchars($rsschannels[$i][0]) . '"><img src="'. ROOT .'images/rss.gif" width="16" height="16" alt="'. htmlspecialchars($rsschannels[$i][0]) .'" /></a>';
 	}
 
 	$pagesBanner = '<p class="paging">'. $bfirst .'<span> / </span>'. $bprev .'<span> / </span>'. $bnext .'<span> / </span>'. $blast .'<span> / </span>'. sprintf(T_('Page %d of %d'), $page, $totalpages) ." ". $brss ." </p>\n";
@@ -352,7 +352,7 @@ if($currenttag!= '') {
 
 		echo '<div '.$adminBgClass.' >';;
 
-		echo '<div class="link"><a href="'. $address .'"'. $rel .' class="taggedlink" target="_blank">'. filter($row['bTitle']) ."</a>" . $adminStar . "</div>\n";
+		echo '<div class="link"><a href="'. htmlspecialchars($address) .'"'. $rel .' class="taggedlink" target="_blank">'. filter($row['bTitle']) ."</a>" . $adminStar . "</div>\n";
 		if ($row['bDescription'] == '') {
 			$bkDescription = $GLOBALS['blankDescription'];
 		} else {
diff --git a/data/templates/sidebar.block.search.php b/data/templates/sidebar.block.search.php
index 64cb8ac..7efc935 100644
--- a/data/templates/sidebar.block.search.php
+++ b/data/templates/sidebar.block.search.php
@@ -18,8 +18,10 @@ if ($lastSearches && count($lastSearches) > 0) {
 <?php
 foreach ($lastSearches as $row) {
     echo '<tr><td>';
-    echo  '<a href="'.createURL('search', $range.'/'.$row['shTerms']).'">';
-    echo $row['shTerms'];
+    echo  '<a href="' . htmlspecialchars(
+        createURL('search', $range.'/'.$row['shTerms'])
+    ) . '">';
+    echo htmlspecialchars($row['shTerms']);
     echo '</a>';
     echo ' <span title="'.T_('Number of bookmarks for this query').'">('.$row['shNbResults'].')</span>';
     echo '</td></tr>';